Look, I get that HIPAA is a bitch. But you really shouldn't use it as a fucking excuse for not bringing yourselves into the fucking 21st century. Requiring me to either show up and fill out a form, download and print out a form to bring with me or download, print out and fax a form is just fucking stupid. Really, that you're still fucking doing FAXing rather than secure email is fucking stupid.
There's 19Mn cloud-services out there that allow for the secure sharing of documents - many of them are even certified for HIPAA, SOX and other data compliance legislation. If you can't afford to set up your own, self-hosted system, use one of those many cloud services.
Fuck: if you can't figure out how to accept S/MIME- or PGP-encrypted emails just let me email you a link to a protected document on a cloud service of my choosing.
You might have room to talk to me about data protection policies if I wasn't about 99.999% certain that some hacker hasn't already rifled your databases. Really. There's lots of secure options out there. Don't be such righteous pains in the dick.